CVE Intelligence
Analysis AI-assisted

CVE-2026-2136: Projectworlds Online Food Ordering System 1.0: SQL Injection in view-ticket.php

A SQL injection flaw has been reported in Projectworlds Online Food Ordering System 1.0, in the ID argument of /view-ticket.php, and it can be triggered remotely. NVD rates it 9.8 (Critical) under CVSS 3.1, and the record states that a published exploit may be used. CISA KEV does not list this CVE, so no confirmed active exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

A SQL injection flaw (CWE-89) affects Projectworlds Online Food Ordering System 1.0. According to the record, the issue lies in an unknown function of the file /view-ticket.php, where manipulation of the ID argument can lead to SQL injection. The NVD entry and the VulDB entry describe the issue.

Impact

  • Successful SQL injection may allow an attacker to read, change or delete data held by the application database, depending on how the database is configured.
  • NVD assigns a score of 9.8 (Critical) under CVSS 3.1 with high confidentiality, integrity and availability impact.
  • The CNA VulDB scores in the record differ (5.5 under CVSS 4.0, 7.3 under CVSS 3.1 and 7.5 under CVSS 2.0), so the severity depends on the scoring source.

Affected products and versions

  • Projectworlds Online Food Ordering System, version 1.0, is the only version listed in the record.
  • The record does not list any fixed version.

Exploitation status

The record states that the exploit has been published and may be used, and that the attack can be launched remotely. This CVE is not listed in the CISA KEV catalog, so no confirmed active exploitation in the wild appears in the sources consulted. The EPSS probability in the record is 0.00379 (percentile 0.29989).

Remediation and mitigation

  • No vendor fixed version is identified in the record. A missing fixed version does not confirm that no fix exists.
  • The record links a GitHub issue tagged as mitigation. Its content was not reviewed for this analysis.
  • Restrict access to the application and its ticket pages to trusted users until the risk is assessed.
  • Ask the software owner or maintainer about a corrected version, and apply parameterized queries and strict input validation to all database-backed parameters.
  • Use web application firewall rules as a temporary compensating control, while recognizing that they do not replace a code fix.
  • If no fix is available, consider removing or replacing the application.

Detection guidance

  • Review web server and application logs for the view-ticket page for unusual, malformed or unexpectedly long values in the ID parameter.
  • Monitor database error messages and unexpected spikes in query volume originating from the web application.
  • Alert on requests from unknown sources targeting this page.

Limitations of the available information

  • The record does not describe the affected function in detail or the exact conditions required for exploitation.
  • No vendor advisory or fixed version is listed.
  • The record contains an EPSS date (2026-10-13) that should be verified against the source before relying on it.
  • The content of the GitHub issue and the VulDB entries was not independently verified in this analysis.

Frequently asked questions

What is the vulnerability in CVE-2026-2136?

It is a SQL injection flaw (CWE-89) in the ID argument handled by /view-ticket.php in Projectworlds Online Food Ordering System 1.0.

Is this CVE being actively exploited?

The record says a published exploit may be used, but this CVE is not listed in CISA KEV, so no confirmed active exploitation appears in the sources consulted.

Is there a fixed version?

The record does not list a fixed version. It links a GitHub issue tagged as mitigation, whose content was not reviewed here.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.